Evidence Family
Menu

Provenance

C2PA Content Credentials explained

Last checked 6 November 2026 · 6 sources

Short answer

Content Credentials: C2PA Technical Specification is the standard for signed provenance records attached to digital files 2. The Coalition for Content Provenance and Authenticity, a project of the Joint Development Foundation, writes the standard 1. A C2PA manifest holds assertions about an asset, bound to it by cryptographic hashes and signed by the party making the claim 2. The specification says it should not judge whether provenance data is good or bad, and it does not test whether content is true 2.
Standard
Content Credentials: C2PA Technical Specification, version 2.2 2
Version date
May 2025, per the version history 2
Issuer
C2PA, a project of the Joint Development Foundation 1
Origins
Combined the efforts of the Content Authenticity Initiative and Project Origin 1
Related vocabulary
IPTC Digital Source Type, with terms such as trainedAlgorithmicMedia 3

Who writes the standard

The Coalition for Content Provenance and Authenticity is a project of the Joint Development Foundation, a Washington-based 501(c)(6) nonprofit 1. C2PA says it combined the efforts of the Content Authenticity Initiative and Project Origin and now focuses on open, global technical standards for content provenance and authenticity 1.

The parts of a Content Credential

TermMeaning in the C2PA specification
ManifestThe set of information about the provenance of an asset, based on one or more assertions 2
AssertionA data structure that represents a statement made by the signer 2
ClaimA digitally signed, tamper-evident data structure that references a set of assertions about an asset 2
Claim signatureThe digital signature on the claim, made with the signer's private key 2
Hard bindingOne or more cryptographic hashes that identify the whole asset or a portion of it 2
Soft bindingA content identifier that is not statistically unique, such as a fingerprint 2
C2PA Trust ListA C2PA-managed list of X.509 certificate trust anchors that issue certificates to hardware and software signers 2

What a credential proves and what it does not

  • It shows who signed a set of statements about a file, and whether the file has changed since. Hard bindings let a validator detect modification 2.
  • It does not rate the content. The specification says C2PA specifications should not provide value judgments about whether provenance data is good or bad 2.
  • It can be lost. The specification says an asset can become separated from its manifest through removal or corruption of metadata 2. A copy kept in a provenance store can be matched back using soft bindings 2.
  • A missing credential is not proof of fakery. The specification expects that manifests can be stripped, so a file without one may have lost it 2.

Labels for AI-made and edited media

C2PA records often carry a source type from the IPTC Digital Source Type vocabulary 3. IPTC defines digitalCapture as media captured from real life, trainedAlgorithmicMedia as media created by a generative AI model, and compositeWithTrainedAlgorithmicMedia as media edited with generative AI, such as inpainting 3. IPTC retired minorHumanEdits and points users to humanEdits 3.

Related provenance building blocks

  • Trusted time-stamps. IETF RFC 3161 describes a Time Stamping Authority that supports assertions of proof that a datum existed before a particular time 4. The authority sees only a hash of the data, so it does not vouch for content 4.
  • W3C PROV. A family of W3C documents, with four Recommendations dated 30 April 2013, that defines provenance as information about entities, activities and people involved in producing data or a thing 5.
  • Newsroom codes. The SPJ Code, revised 4 October 2026, asks journalists to verify the provenance and authenticity of the methods, sources and technology used to produce news 6.

Common questions

Does a Content Credential prove a photo is real?

No. It shows signed statements about the file and whether it changed. The C2PA specification says its specifications should not judge whether provenance data is good or bad 2.

Can Content Credentials be removed?

Yes. The specification says an asset can become separated from its manifest when metadata is removed or corrupted 2.

Who runs C2PA?

C2PA is a project of the Joint Development Foundation 1.

How is AI-generated media labelled?

A common label is the IPTC Digital Source Type term trainedAlgorithmicMedia, meaning created using generative AI 3.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@evidencefamily.com.

Sources

  1. C2PA: About C2PA
  2. C2PA: Content Credentials, C2PA Technical Specification 2.2 (May 2025)
  3. IPTC: NewsCodes Scheme (Controlled Vocabulary), Digital Source Type
  4. IETF: RFC 3161, Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)
  5. W3C: PROV-Overview (Working Group Note, 30 April 2013)
  6. Society of Professional Journalists: SPJ's Code of Ethics (revised 4 October 2026)

Related

  • How to trace a story to its source

    A step-by-step method for following a claim upstream through credits, agency copy, documents and file provenance, based on published rules.

  • Duplicate publication rules in research

    What the ICMJE Recommendations say about duplicate and secondary publication, preprints and registry results, and why it matters for evidence.

  • Attribution terms explained

    What common attribution phrases signal about where a fact came from, and what published newsroom codes in the US, UK and Germany say about using them.

  • Circular reporting explained

    How one source can look like many, what newsroom guides and US intelligence reviews say about it, and the checks that published standards set out.